CVE-2017-16994

MEDIUM

Linux Kernel <4.14.2 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2017-16994. PoCs published by Google Security Research, anonymous, jedai47.

AI-analyzed exploit summary This exploit demonstrates an information leak vulnerability in the Linux kernel's mincore system call when handling VM_HUGETLB VMAs. It triggers uninitialized memory disclosure by repeatedly calling mincore on a large anonymous hugepage mapping.

Description

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdoslinux
https://www.exploit-db.com/exploits/43178

This exploit demonstrates an information leak vulnerability in the Linux kernel's mincore system call when handling VM_HUGETLB VMAs. It triggers uninitialized memory disclosure by repeatedly calling mincore on a large anonymous hugepage mapping.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel versions before 4.14.2, 4.13.16, 4.9.65, and 4.4.101
No auth needed
Prerequisites: Linux system with vulnerable kernel · Ability to execute unprivileged user code
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by anonymous · clocallinux
https://www.exploit-db.com/exploits/44303

This exploit leverages CVE-2017-16994 to bypass KASLR and disable mmap_min_addr protections, followed by a null pointer dereference to achieve privilege escalation via shellcode execution. It requires a custom kernel module (/proc/test) to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel (custom module required)
No auth needed
Prerequisites: Kernel with KASLR enabled · Custom kernel module (/proc/test) loaded · Read access to /proc/kallsyms
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by anonymous · cdoslinux
https://www.exploit-db.com/exploits/44304

This exploit leverages an information leak vulnerability (CVE-2017-16994) in the Linux kernel's handling of MAP_HUGETLB mappings. It uses mincore to trigger uninitialized memory disclosure, revealing kernel addresses to bypass KASLR.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions affected by CVE-2017-16994)
No auth needed
Prerequisites: Linux system with vulnerable kernel · Ability to execute unprivileged code
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by jedai47 · poc
https://github.com/jedai47/CVE-2017-16994

This repository contains a proof-of-concept exploit for CVE-2017-16994, which involves bypassing KASLR and disabling mmap_min_addr to achieve local privilege escalation via a null pointer dereference in the Linux kernel.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (custom compiled, version not specified)
No auth needed
Prerequisites: Access to /proc/kallsyms · Custom kernel with specific offsets · Ability to load a kernel module (/proc/test)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13
Core References
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-2/
Exploit, Issue Tracking, Patch x_refsource_confirm
https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-3/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43178/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3632-1/
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0502
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3617-2/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3619-1/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101969

Scores

CVSS v3 5.5
EPSS 0.0480
EPSS Percentile 89.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
linux/linux_kernel < 4.14.2
Published Nov 27, 2017
Tracked Since Feb 18, 2026